repo-brief is local-first and does not make network calls.
The scanner intentionally skips common sensitive env files such as .env, .env.local, .env.production, and .env.test. It reports their filenames so maintainers know those assumptions exist, but it does not read or print their contents.
Do not add code that reads secrets, tokens, credentials, or private keys into generated briefs.
Open a GitHub issue with:
- affected version
- operating system
- minimal reproduction
- expected behavior
- actual behavior
Do not paste real secrets into public issues.